Linux kernel efa driver: admin-queue completion context used after free on command error

Impact

When an efa admin command completes with an error, the driver prints data out of a completion context that the polling/interrupt handler already freed, so it reads memory that may have been reallocated for something else. efa is the RDMA transport on AWS GPU instances, where it carries all-reduce traffic between nodes in a training cluster. The practical consequences are kernel-log disclosure of whatever now occupies that memory and corruption in the fabric control path; a wedged RDMA device on one node stalls the whole collective. The admin queue is driven by the driver, not by tenants, so this is a reliability and info-leak bug rather than a tenant-reachable escalation.

Who can reach it

Local to the host. The efa admin queue is not exposed to tenant processes or to the network; reaching the bug requires an admin command to fail, which normally comes from device or driver state rather than from a caller.

What to do

Move to a stable kernel containing the fix (five stable branches have it, per the commits in the record). efa is a module, but unloading it tears down every RDMA queue pair on the node, so in practice this is a node drain followed by reboot rather than a live module swap. No vendor mitigation is described in the record.

References

Related entries

• Linux kernel irdma: failed memory-region re-registration leaves a stale umem, leading to double freeCVE-2026-43120 · Linux kernel RDMA/irdma (rereg_user_mr memory-region re-registration)High
• Linux kernel InfiniBand core dmabuf umem (GPUDirect RDMA path): When mapping a dmabuf-backed RDMA memory region failsCVE-2026-43128 · Linux kernel InfiniBand core dmabuf umem (GPUDirect RDMA path)High
• Linux bnxt_en driver (RSS context delete logic): RSS contexts are not always freed in firmware when the driver deletesCVE-2026-43260 · Linux bnxt_en driver (RSS context delete logic)High
• Linux kernel Soft-RoCE shared receive queue (rdma_rxe, rxe_srq_from_init): If the copy_to_user() that returns the SRQCVE-2026-45852 · Linux kernel Soft-RoCE shared receive queue (rdma_rxe, rxe_srq_from_init)High
• Linux kernel (drivers/infiniband/sw/rxe): The soft-RoCE retransmit and ack timers race against queue-pair destructionCVE-2026-45910 · Linux kernel (drivers/infiniband/sw/rxe)High
• Linux kernel RDS RDMA (memory-region cleanup on cookie copy failure): Once __rds_rdma_map() has handed theCVE-2026-46053 · Linux kernel RDS RDMA (memory-region cleanup on cookie copy failure)High